T1538 — Cloud Service Dashboard

Tactic: Discovery · Platforms: IaaS, SaaS, Office Suite, Identity Provider

An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment, such as specific services, resources, and features. For example, the GCP Command Center can be used to view all assets, review findings of potential security…

Sigma detection rules (4)

T1538 Cloud Service Dashboard

title: T1538 Cloud Service Dashboard
id: 2cc63303-1881-4eda-bfd0-323627519bcb
description: 'Detection of Cloud Service Dashboard Usage via GUI-Based Cloud Access. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UserAgentFilter, TimeWindow, PrivilegedSessionThreshold.'
references:
  - https://attack.mitre.org/techniques/T1538
author: Shahrukh Khan
date: 2026-04-26
license: MIT
tags:
  - attack.discovery
  - attack.t1538

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventName: 'ConsoleLogin'
    userAgent|contains:
      - 'python-requests'
      - 'curl'
      - 'Go-http-client'

  condition: selection

falsepositives:
  - Automated compliance or SSO health-check scripts that programmatically verify console login availability outside a normal browser.

level: medium

T1538 Cloud Service Dashboard

title: T1538 Cloud Service Dashboard
id: 49489ecd-490a-4f7b-be57-06caea73e198
description: 'Detection of Cloud Service Dashboard Usage via GUI-Based Cloud Access. (Data Component: Logon Session Creation; baseline tier: fallback.) Tune using: SaaSDashboardViewList, IPReputationThreshold, LoginBehaviorBaseline.'
references:
  - https://attack.mitre.org/techniques/T1538
author: Shahrukh Khan
date: 2026-03-01
license: MIT
tags:
  - attack.discovery
  - attack.t1538

logsource:
  product: saas
  service: zoom

detection:
  selection:
    category_type: 'Account'
    operation: 'Sign in'

  condition: selection

falsepositives:
  - Routine administrator sign-ins to the Zoom account dashboard for daily operational tasks; distinguishing reconnaissance browsing from normal admin use needs behavioral baselining not present in a single sign-in event.

level: informational

T1538 Cloud Service Dashboard

title: T1538 Cloud Service Dashboard
id: 4e0944ad-7b8c-414d-8e39-66481ccd61eb
description: 'Detection of Cloud Service Dashboard Usage via GUI-Based Cloud Access. (Data Component: User Account Authentication; baseline tier: fallback.) Tune using: GeoIPAnomalyThreshold, UserAgentReputation, PrivilegedPageAccess.'
references:
  - https://attack.mitre.org/techniques/T1538
author: Shahrukh Khan
date: 2026-05-12
license: MIT
tags:
  - attack.discovery
  - attack.t1538

logsource:
  product: azure
  service: signinlogs

detection:
  selection:
    ResultType: '0'
    AppDisplayName:
      - 'Azure Portal'
      - 'Microsoft Azure PowerShell'
      - 'Microsoft Azure CLI'
  filter_expected:
    ConditionalAccessStatus: 'success'
  condition: selection and not filter_expected

falsepositives:
  - Legitimate administrators reviewing Azure Portal dashboards outside enforced Conditional Access baselines; cannot reliably distinguish reconnaissance navigation clicks from routine admin work with sign-in log fields alone.

level: low

T1538 Cloud Service Dashboard

title: T1538 Cloud Service Dashboard
id: ffb9f607-2195-4e33-a591-e8627246ad05
description: 'Detection of Cloud Service Dashboard Usage via GUI-Based Cloud Access. (Data Component: User Account Authentication; baseline tier: fallback.) Tune using: AdminRoleList, DashboardNavigationSequence, GeoLocationRisk.'
references:
  - https://attack.mitre.org/techniques/T1538
author: Shahrukh Khan
date: 2026-01-28
license: MIT
tags:
  - attack.discovery
  - attack.t1538

logsource:
  product: m365
  service: signinlogs

detection:
  selection:
    AppDisplayName:
      - 'Microsoft 365 admin center'
      - 'Office 365 Exchange Online'
    AuthenticationRequirement: 'singleFactorAuthentication'
  filter_risk:
    RiskState: 'none'
  condition: selection and not filter_risk

falsepositives:
  - Administrators legitimately browsing the M365 admin center without MFA on trusted networks where Conditional Access has not been fully enforced.

level: low

Explore